timecompare

Use the timecompare command to generate columns with the results from all the aggregate columns generated by the previous timestats command over the comparison interval specified. Note that timecompare command must follow a timestats command.

Syntax

timecompare shift=<int><timescale> [count=<int>]

Parameters

The following table lists the parameters used in this command, along with their descriptions.

Parameter Description

span

Syntax: [span = <int><timescale>]

Sets the size of each compare window using a span length based on time.

timescale

Syntax: <sec> | <min> | <hour> | <day> | <week> | <mon>

where:

<sec>: Seconds. Syntax: s | sec | secs | second | seconds

<min>: Minutes. Syntax: m | min | mins | minute | minutes

<hour>: Hours. Syntax: h | hr | hrs | hour | hours

<week>: Weeks. Syntax: w | week | weeks

<month>: Months.

The following command compares the log volume by the number of log lines week over week.

* | timestats span=1d count | timecompare shift=1w

The following command compares the count of errors by an entity week over week.

Severity = error | timestats span=1d count by Entity | timecompare shift=5days 2";